Mini-Inventory-and-Sales-Management-System CVE-2026-100887

Requires an authenticated session (vendor CVSS PR:L) on a deployed Mini-Inventory-and-Sales-Management-System instance and the ability to control the value passed to the order_by()/orderBy argument that flows into DB_query_builder.php. Exploitation is limited by: (1) the injection residing in the ORDER BY clause, which constrains extraction to blind/inferential techniques rather than direct UNION dumps; (2) the need for valid low-privilege credentials; and (3) the tiny, unsupported deployment base of this abandoned project. No non-default configuration is otherwise required - any running instance exposing the affected sort parameter to an authenticated user is vulnerable, and the maintainer has stated it will not be fixed.

This is a genuine vulnerability but a LOW real-world priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) shows remote, low-complexity, authenticated exploitation, and CWE-89 SQL injection is confirmed by VulDB. The vendor-assigned severity is only 5.3 (Medium) with VC:L/VI:L/VA:L, reflecting that the injection point is the ORDER BY clause via the order_by() function - a constrained sink where UNION-based extraction is difficult and blind/time-based techniques are the realistic path, limiting impact versus a WHERE-clause injection. Exploit maturity is E:P (Proof-of-Concept) and a public exploit gist exists, so the barrier to abuse is low. However, no EPSS score and no CISA KEV listing are present in the input, so there is no evidence of automated or widespread exploitation - this reads as opportunistic-at-best rather than a mass-exploited flaw. The decisive risk-reducer is the product itself: an unmaintained hobby project that the maintainer explicitly refuses to fix, with negligible enterprise deployment. POC availability and active exploitation are distinct signals - only the former is present here.

An authenticated low-privilege user of a Mini-Inventory-and-Sales-Management-System instance submits a crafted value in a request parameter that reaches the order_by()/orderBy argument, injecting SQL into the ORDER BY clause of a query built by DB_query_builder.php. Using blind boolean/time-based techniques, the attacker enumerates and exfiltrates database contents such as user credentials or sales records. A public proof-of-concept exploit is available (gist by qianqiusujiu), lowering the effort required.